@viberaven/cli 1.6.11 → 1.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +5 -5
- package/README.md +11 -11
- package/dist/cli.js +4908 -1902
- package/dist/github-ci.js +1645 -0
- package/dist/stack/app.js +14 -14
- package/dist/stack/scene.css +38 -0
- package/package.json +7 -6
- package/schemas/verification-plan.schema.json +350 -0
- package/schemas/verification-report.schema.json +550 -0
- package/templates/AGENTS.snippet.md +3 -3
- package/templates/CLAUDE.snippet.md +1 -1
- package/templates/CURSOR.snippet.md +1 -1
package/dist/stack/scene.css
CHANGED
|
@@ -482,3 +482,41 @@
|
|
|
482
482
|
/* Shared with stack.css, copied so this file stands alone. */
|
|
483
483
|
@keyframes pulse-dot { 50% { opacity: 0.3; } }
|
|
484
484
|
@keyframes settle { from { transform: translateY(4px); } to { transform: none; } }
|
|
485
|
+
|
|
486
|
+
/* Codex's voxel bot: blue, with a terminal for a face. It types while it works; the cursor blinks. */
|
|
487
|
+
.scene .cx .f-top { fill: #6f9bff; }
|
|
488
|
+
.scene .cx .f-left { fill: #2f6bf0; }
|
|
489
|
+
.scene .cx .f-right { fill: #1d4cc4; }
|
|
490
|
+
.scene .cx-cap .f-top { fill: #a9c4ff; }
|
|
491
|
+
.scene .cx-cap .f-left { fill: #6f9bff; }
|
|
492
|
+
.scene .cx-cap .f-right { fill: #4f80ec; }
|
|
493
|
+
.scene .cx .edge { stroke: rgba(255, 255, 255, 0.45); }
|
|
494
|
+
.scene .cx-screen { fill: #0b1020; stroke: rgba(160, 196, 255, 0.55); stroke-width: 1; vector-effect: non-scaling-stroke; }
|
|
495
|
+
.scene .cx-prompt { fill: none; stroke: #b9d0ff; stroke-width: 1.6; stroke-linecap: round; stroke-linejoin: round; vector-effect: non-scaling-stroke; }
|
|
496
|
+
.scene .cx-cursor { fill: #b9d0ff; animation: cx-blink 1.1s steps(1) infinite; }
|
|
497
|
+
.scene .codex-bot .cx-torso, .scene .codex-bot .cx-arm { transform-box: fill-box; transform-origin: 50% 100%; }
|
|
498
|
+
.scene .p-active .codex-bot .cx-torso { animation: cx-bob 0.36s ease-in-out infinite alternate; }
|
|
499
|
+
.scene .p-active .codex-bot .cx-arm.a { animation: cx-tap 0.16s ease-in-out infinite alternate; }
|
|
500
|
+
.scene .p-active .codex-bot .cx-arm.b { animation: cx-tap 0.16s ease-in-out infinite alternate-reverse; }
|
|
501
|
+
.scene .p-active .codex-bot .cx-cursor { animation-duration: 0.5s; }
|
|
502
|
+
.scene .p-done .codex-bot { animation: happy 0.5s var(--spring) 2 alternate; transform-box: fill-box; transform-origin: 50% 100%; }
|
|
503
|
+
.scene .p-planned .codex-bot .f-top, .scene .p-planned .codex-bot .f-left, .scene .p-planned .codex-bot .f-right { fill-opacity: 0.12; stroke: rgba(47, 107, 240, 0.55); }
|
|
504
|
+
.scene .p-planned .codex-bot .cx-screen, .scene .p-planned .codex-bot .cx-prompt, .scene .p-planned .codex-bot .cx-cursor { opacity: 0.35; }
|
|
505
|
+
@keyframes cx-blink { 50% { opacity: 0; } }
|
|
506
|
+
@keyframes cx-bob { from { transform: translateY(0); } to { transform: translateY(-2px); } }
|
|
507
|
+
@keyframes cx-tap { from { transform: translateY(0); } to { transform: translateY(-3px); } }
|
|
508
|
+
.scene.is-wait .codex-bot * { animation-play-state: paused; }
|
|
509
|
+
@media (prefers-reduced-motion: reduce) { .scene .codex-bot, .scene .codex-bot * { animation: none !important; } }
|
|
510
|
+
|
|
511
|
+
/* What Codex and Gemini fire along the beam while they edit (Claude Code has its spark and tokens). */
|
|
512
|
+
.scene .cx-shot rect { fill: #b9d0ff; stroke: #2f6bf0; stroke-width: 1; filter: drop-shadow(0 0 4px rgba(76, 141, 255, 0.9)); }
|
|
513
|
+
.scene .cx-shot:nth-child(2) rect { fill: #e6eeff; }
|
|
514
|
+
.scene .gm-shot path { filter: drop-shadow(0 0 5px rgba(155, 114, 203, 0.9)); }
|
|
515
|
+
.scene .gm-shot.s0 path { fill: #4285F4; }
|
|
516
|
+
.scene .gm-shot.s1 path { fill: #9b72cb; }
|
|
517
|
+
.scene .gm-shot.s2 path { fill: #d96570; }
|
|
518
|
+
.scene .gm-spin { animation: gm-spin 0.9s linear infinite; }
|
|
519
|
+
@keyframes gm-spin { to { transform: rotate(180deg); } }
|
|
520
|
+
/* A provider's own pad beside the board: a little lower-key than the board itself. */
|
|
521
|
+
.scene .provider-pad .ground .f-top { fill: #1b1b21; }
|
|
522
|
+
@media (prefers-reduced-motion: reduce) { .scene .cx-shots, .scene .gm-shots { display: none; } }
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@viberaven/cli",
|
|
3
|
-
"version": "1.
|
|
4
|
-
"description": "VibeRaven CLI and local Studio: Supabase RLS and security check for AI-built Vercel + Supabase apps, with an agent task list and fix prompts.",
|
|
3
|
+
"version": "1.7.0",
|
|
4
|
+
"description": "VibeRaven CLI and local Studio: pre-launch Supabase RLS and security check for AI-built Vercel + Supabase apps (tables without RLS, using (true) policies, service_role keys in client code, anon-callable security definer functions), with an agent task list and fix prompts.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "VibeRaven",
|
|
7
7
|
"homepage": "https://viberaven.dev",
|
|
@@ -15,9 +15,9 @@
|
|
|
15
15
|
},
|
|
16
16
|
"keywords": [
|
|
17
17
|
"viberaven",
|
|
18
|
-
"launch-
|
|
18
|
+
"launch-checklist",
|
|
19
19
|
"production-readiness",
|
|
20
|
-
"
|
|
20
|
+
"vibe-coding",
|
|
21
21
|
"ai-built-apps",
|
|
22
22
|
"mcp",
|
|
23
23
|
"claude-code",
|
|
@@ -42,7 +42,7 @@
|
|
|
42
42
|
],
|
|
43
43
|
"publishConfig": {
|
|
44
44
|
"access": "public",
|
|
45
|
-
"tag": "
|
|
45
|
+
"tag": "next"
|
|
46
46
|
},
|
|
47
47
|
"bin": {
|
|
48
48
|
"viberaven": "dist/cli.js"
|
|
@@ -58,13 +58,14 @@
|
|
|
58
58
|
"scripts": {
|
|
59
59
|
"sync-report-assets": "node scripts/sync-report-assets.mjs",
|
|
60
60
|
"build": "node scripts/build.mjs",
|
|
61
|
+
"build:mcp-rules": "node scripts/build-mcp-rules.mjs",
|
|
61
62
|
"dev": "node scripts/build.mjs && node dist/cli.js",
|
|
62
63
|
"typecheck": "tsc -p tsconfig.json",
|
|
63
64
|
"demo-report": "node scripts/demo-report.mjs --open",
|
|
64
65
|
"verify:release:smoke": "npm run build && node scripts/verify-beta-flow.mjs --smoke",
|
|
65
66
|
"verify:release:live": "npm run build && node scripts/verify-beta-flow.mjs --live",
|
|
66
67
|
"test": "vitest run",
|
|
67
|
-
"prepublishOnly": "npm run sync-report-assets && npm run check:agent-discovery && npm run typecheck && npm run
|
|
68
|
+
"prepublishOnly": "npm run sync-report-assets && npm run check:agent-discovery && npm run typecheck && npm run build && npm run test",
|
|
68
69
|
"check:agent-discovery": "node scripts/check-agent-discovery.mjs",
|
|
69
70
|
"viberaven:gate": "npx -y viberaven --agent-mode",
|
|
70
71
|
"viberaven:verify": "npx -y viberaven --verify",
|
|
@@ -0,0 +1,350 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"title": "VibeRaven local verification plan v1",
|
|
4
|
+
"type": "object",
|
|
5
|
+
"properties": {
|
|
6
|
+
"schemaVersion": {
|
|
7
|
+
"const": 1
|
|
8
|
+
},
|
|
9
|
+
"checks": {
|
|
10
|
+
"type": "array",
|
|
11
|
+
"minItems": 1,
|
|
12
|
+
"maxItems": 32,
|
|
13
|
+
"items": {
|
|
14
|
+
"oneOf": [
|
|
15
|
+
{
|
|
16
|
+
"type": "object",
|
|
17
|
+
"properties": {
|
|
18
|
+
"id": {
|
|
19
|
+
"type": "string",
|
|
20
|
+
"pattern": "^[a-z][a-z0-9_-]{0,39}$"
|
|
21
|
+
},
|
|
22
|
+
"conditionId": {
|
|
23
|
+
"type": "string",
|
|
24
|
+
"pattern": "^[a-z][a-z0-9_-]{0,39}$"
|
|
25
|
+
},
|
|
26
|
+
"adapter": {
|
|
27
|
+
"const": "module"
|
|
28
|
+
},
|
|
29
|
+
"module": {
|
|
30
|
+
"type": "string",
|
|
31
|
+
"minLength": 1,
|
|
32
|
+
"maxLength": 200,
|
|
33
|
+
"pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
|
|
34
|
+
},
|
|
35
|
+
"export": {
|
|
36
|
+
"type": "string",
|
|
37
|
+
"pattern": "^[A-Za-z_$][A-Za-z0-9_$]{0,79}$"
|
|
38
|
+
},
|
|
39
|
+
"cases": {
|
|
40
|
+
"type": "array",
|
|
41
|
+
"minItems": 1,
|
|
42
|
+
"maxItems": 32,
|
|
43
|
+
"items": {
|
|
44
|
+
"type": "object",
|
|
45
|
+
"properties": {
|
|
46
|
+
"args": {
|
|
47
|
+
"type": "array",
|
|
48
|
+
"maxItems": 16
|
|
49
|
+
},
|
|
50
|
+
"expected": {}
|
|
51
|
+
},
|
|
52
|
+
"required": [
|
|
53
|
+
"args",
|
|
54
|
+
"expected"
|
|
55
|
+
],
|
|
56
|
+
"additionalProperties": false
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
},
|
|
60
|
+
"required": [
|
|
61
|
+
"id",
|
|
62
|
+
"conditionId",
|
|
63
|
+
"adapter",
|
|
64
|
+
"module",
|
|
65
|
+
"export",
|
|
66
|
+
"cases"
|
|
67
|
+
],
|
|
68
|
+
"additionalProperties": false
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"type": "object",
|
|
72
|
+
"properties": {
|
|
73
|
+
"id": {
|
|
74
|
+
"type": "string",
|
|
75
|
+
"pattern": "^[a-z][a-z0-9_-]{0,39}$"
|
|
76
|
+
},
|
|
77
|
+
"conditionId": {
|
|
78
|
+
"type": "string",
|
|
79
|
+
"pattern": "^[a-z][a-z0-9_-]{0,39}$"
|
|
80
|
+
},
|
|
81
|
+
"adapter": {
|
|
82
|
+
"const": "node-test"
|
|
83
|
+
},
|
|
84
|
+
"entry": {
|
|
85
|
+
"type": "string",
|
|
86
|
+
"minLength": 1,
|
|
87
|
+
"maxLength": 200,
|
|
88
|
+
"pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
|
|
89
|
+
},
|
|
90
|
+
"frozenPaths": {
|
|
91
|
+
"type": "array",
|
|
92
|
+
"minItems": 0,
|
|
93
|
+
"maxItems": 16,
|
|
94
|
+
"uniqueItems": true,
|
|
95
|
+
"items": {
|
|
96
|
+
"type": "string",
|
|
97
|
+
"minLength": 1,
|
|
98
|
+
"maxLength": 200,
|
|
99
|
+
"pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
|
|
100
|
+
}
|
|
101
|
+
}
|
|
102
|
+
},
|
|
103
|
+
"required": [
|
|
104
|
+
"id",
|
|
105
|
+
"conditionId",
|
|
106
|
+
"adapter",
|
|
107
|
+
"entry",
|
|
108
|
+
"frozenPaths"
|
|
109
|
+
],
|
|
110
|
+
"additionalProperties": false
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"type": "object",
|
|
114
|
+
"properties": {
|
|
115
|
+
"id": {
|
|
116
|
+
"type": "string",
|
|
117
|
+
"pattern": "^[a-z][a-z0-9_-]{0,39}$"
|
|
118
|
+
},
|
|
119
|
+
"conditionId": {
|
|
120
|
+
"type": "string",
|
|
121
|
+
"pattern": "^[a-z][a-z0-9_-]{0,39}$"
|
|
122
|
+
},
|
|
123
|
+
"adapter": {
|
|
124
|
+
"const": "http"
|
|
125
|
+
},
|
|
126
|
+
"module": {
|
|
127
|
+
"type": "string",
|
|
128
|
+
"minLength": 1,
|
|
129
|
+
"maxLength": 200,
|
|
130
|
+
"pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
|
|
131
|
+
},
|
|
132
|
+
"export": {
|
|
133
|
+
"type": "string",
|
|
134
|
+
"pattern": "^[A-Za-z_$][A-Za-z0-9_$]{0,79}$"
|
|
135
|
+
},
|
|
136
|
+
"cases": {
|
|
137
|
+
"type": "array",
|
|
138
|
+
"minItems": 1,
|
|
139
|
+
"maxItems": 32,
|
|
140
|
+
"items": {
|
|
141
|
+
"type": "object",
|
|
142
|
+
"properties": {
|
|
143
|
+
"request": {
|
|
144
|
+
"type": "object",
|
|
145
|
+
"properties": {
|
|
146
|
+
"method": {
|
|
147
|
+
"enum": [
|
|
148
|
+
"GET",
|
|
149
|
+
"HEAD",
|
|
150
|
+
"POST",
|
|
151
|
+
"PUT",
|
|
152
|
+
"PATCH",
|
|
153
|
+
"DELETE",
|
|
154
|
+
"OPTIONS"
|
|
155
|
+
]
|
|
156
|
+
},
|
|
157
|
+
"path": {
|
|
158
|
+
"type": "string",
|
|
159
|
+
"minLength": 1,
|
|
160
|
+
"maxLength": 2048,
|
|
161
|
+
"allOf": [
|
|
162
|
+
{
|
|
163
|
+
"pattern": "^/(?!/)(?!.*%(?:0[0-9a-fA-F]|1[0-9a-fA-F]|20|7[fF]|5[cC]))[!-~]*$(?![\\s\\S])"
|
|
164
|
+
},
|
|
165
|
+
{
|
|
166
|
+
"not": {
|
|
167
|
+
"pattern": "[\\\\#]"
|
|
168
|
+
}
|
|
169
|
+
}
|
|
170
|
+
]
|
|
171
|
+
},
|
|
172
|
+
"headers": {
|
|
173
|
+
"type": "object",
|
|
174
|
+
"maxProperties": 8,
|
|
175
|
+
"propertyNames": {
|
|
176
|
+
"pattern": "^(?:accept|content-type|stripe-signature|x-(?:fixture|test)-[a-z0-9-]{1,40})$(?![\\s\\S])"
|
|
177
|
+
},
|
|
178
|
+
"additionalProperties": {
|
|
179
|
+
"type": "string",
|
|
180
|
+
"maxLength": 512,
|
|
181
|
+
"pattern": "^[ -~]*$(?![\\s\\S])"
|
|
182
|
+
}
|
|
183
|
+
},
|
|
184
|
+
"body": {
|
|
185
|
+
"type": "string",
|
|
186
|
+
"maxLength": 8192
|
|
187
|
+
}
|
|
188
|
+
},
|
|
189
|
+
"required": [
|
|
190
|
+
"method",
|
|
191
|
+
"path"
|
|
192
|
+
],
|
|
193
|
+
"additionalProperties": false,
|
|
194
|
+
"allOf": [
|
|
195
|
+
{
|
|
196
|
+
"if": {
|
|
197
|
+
"properties": {
|
|
198
|
+
"method": {
|
|
199
|
+
"enum": [
|
|
200
|
+
"GET",
|
|
201
|
+
"HEAD"
|
|
202
|
+
]
|
|
203
|
+
}
|
|
204
|
+
}
|
|
205
|
+
},
|
|
206
|
+
"then": {
|
|
207
|
+
"not": {
|
|
208
|
+
"required": [
|
|
209
|
+
"body"
|
|
210
|
+
]
|
|
211
|
+
}
|
|
212
|
+
}
|
|
213
|
+
}
|
|
214
|
+
]
|
|
215
|
+
},
|
|
216
|
+
"expected": {
|
|
217
|
+
"type": "object",
|
|
218
|
+
"properties": {
|
|
219
|
+
"status": {
|
|
220
|
+
"type": "integer",
|
|
221
|
+
"minimum": 200,
|
|
222
|
+
"maximum": 599
|
|
223
|
+
},
|
|
224
|
+
"json": {},
|
|
225
|
+
"text": {
|
|
226
|
+
"type": "string",
|
|
227
|
+
"maxLength": 8192
|
|
228
|
+
}
|
|
229
|
+
},
|
|
230
|
+
"required": [
|
|
231
|
+
"status"
|
|
232
|
+
],
|
|
233
|
+
"additionalProperties": false,
|
|
234
|
+
"oneOf": [
|
|
235
|
+
{
|
|
236
|
+
"required": [
|
|
237
|
+
"json"
|
|
238
|
+
],
|
|
239
|
+
"not": {
|
|
240
|
+
"required": [
|
|
241
|
+
"text"
|
|
242
|
+
]
|
|
243
|
+
}
|
|
244
|
+
},
|
|
245
|
+
{
|
|
246
|
+
"required": [
|
|
247
|
+
"text"
|
|
248
|
+
],
|
|
249
|
+
"not": {
|
|
250
|
+
"required": [
|
|
251
|
+
"json"
|
|
252
|
+
]
|
|
253
|
+
}
|
|
254
|
+
}
|
|
255
|
+
],
|
|
256
|
+
"allOf": [
|
|
257
|
+
{
|
|
258
|
+
"if": {
|
|
259
|
+
"properties": {
|
|
260
|
+
"status": {
|
|
261
|
+
"enum": [
|
|
262
|
+
204,
|
|
263
|
+
205,
|
|
264
|
+
304
|
|
265
|
+
]
|
|
266
|
+
}
|
|
267
|
+
}
|
|
268
|
+
},
|
|
269
|
+
"then": {
|
|
270
|
+
"required": [
|
|
271
|
+
"text"
|
|
272
|
+
],
|
|
273
|
+
"properties": {
|
|
274
|
+
"text": {
|
|
275
|
+
"const": ""
|
|
276
|
+
}
|
|
277
|
+
},
|
|
278
|
+
"not": {
|
|
279
|
+
"required": [
|
|
280
|
+
"json"
|
|
281
|
+
]
|
|
282
|
+
}
|
|
283
|
+
}
|
|
284
|
+
}
|
|
285
|
+
]
|
|
286
|
+
}
|
|
287
|
+
},
|
|
288
|
+
"required": [
|
|
289
|
+
"request",
|
|
290
|
+
"expected"
|
|
291
|
+
],
|
|
292
|
+
"additionalProperties": false,
|
|
293
|
+
"allOf": [
|
|
294
|
+
{
|
|
295
|
+
"if": {
|
|
296
|
+
"properties": {
|
|
297
|
+
"request": {
|
|
298
|
+
"properties": {
|
|
299
|
+
"method": {
|
|
300
|
+
"const": "HEAD"
|
|
301
|
+
}
|
|
302
|
+
}
|
|
303
|
+
}
|
|
304
|
+
}
|
|
305
|
+
},
|
|
306
|
+
"then": {
|
|
307
|
+
"properties": {
|
|
308
|
+
"expected": {
|
|
309
|
+
"required": [
|
|
310
|
+
"text"
|
|
311
|
+
],
|
|
312
|
+
"properties": {
|
|
313
|
+
"text": {
|
|
314
|
+
"const": ""
|
|
315
|
+
}
|
|
316
|
+
},
|
|
317
|
+
"not": {
|
|
318
|
+
"required": [
|
|
319
|
+
"json"
|
|
320
|
+
]
|
|
321
|
+
}
|
|
322
|
+
}
|
|
323
|
+
}
|
|
324
|
+
}
|
|
325
|
+
}
|
|
326
|
+
]
|
|
327
|
+
}
|
|
328
|
+
}
|
|
329
|
+
},
|
|
330
|
+
"required": [
|
|
331
|
+
"id",
|
|
332
|
+
"conditionId",
|
|
333
|
+
"adapter",
|
|
334
|
+
"module",
|
|
335
|
+
"export",
|
|
336
|
+
"cases"
|
|
337
|
+
],
|
|
338
|
+
"additionalProperties": false
|
|
339
|
+
}
|
|
340
|
+
]
|
|
341
|
+
}
|
|
342
|
+
}
|
|
343
|
+
},
|
|
344
|
+
"required": [
|
|
345
|
+
"schemaVersion",
|
|
346
|
+
"checks"
|
|
347
|
+
],
|
|
348
|
+
"additionalProperties": false,
|
|
349
|
+
"description": "Reviewed local observations, not commands or imported proof. Runtime also bounds JSON depth/UTF-8 bytes, including HTTP request/expected bodies to 8192 bytes, rejects unknown condition IDs, and restricts node-test to preservation conditions and frozen test-owned paths. HTTP factories return unlistened Node servers; sequential requests observe volatile state only. Runtime package/config files remain candidate inputs. Expected values remain in the host comparator. Coverage completeness is a human judgment."
|
|
350
|
+
}
|